Bring some order and sanity to error handling in the xml patch.

Use a TRY block instead of (inadequate) ad-hoc coding to ensure that
libxml is cleaned up after a failure.  Report the intended SQLCODE
instead of defaulting to XX000.  Avoid risking use of a dangling
pointer by keeping the persistent error buffer in TopMemoryContext.
Be less trusting that error messages don't contain %.

This patch doesn't do anything about changing the way the messages
are put together --- this is just about mechanism.